Does SOX 404 Have Teeth? Consequences of the Failure to Report Existing Internal Control Weaknesses

Abstract

We examine various penalties that could serve as enforcement mechanisms for Sarbanes-Oxley (SOX) Section 404. We focus on firms with restatements, some of which had previously reported their control weaknesses as required and some of which acknowledged them only after announcing their restatement. We find no evidence that penalties are more likely for firms, managers, or auditors that fail to report existing control weaknesses. Instead, class action lawsuits, management turnover, and auditor turnover are all more likely in the wake of a restatement when control weaknesses had previously been reported. We find similar, although weaker, evidence for Securities and Exchange Commission (SEC) sanctions. These results are consistent with disclosure of control weaknesses making it difficult for management to plausibly claim later that they were unaware of the underlying conditions that led to restatements. The results also suggest that the public and private enforcement mechanisms surrounding SOX 404 are unlikely to provide strong incentives for compliance and offer a potential explanation for why most restatements are issued by firms that previously claimed to have effective internal controls.

Internal Control Opinion Shopping and Audit Market Competition

“…Of particular relevance is our evidence that significant opinion shopping activity appears to exist among firms that have clean internal control opinions in advance of financial statement restatements. Our results also corroborate recent academic research indicating that material weakness disclosures cannot reliably be used as advance warning systems for financial reporting problems (e.g., Weber 2012, Scholz 2014) and that the costs of disclosing material weaknesses seem to outweigh the corresponding benefits (e.g., Rice et al 2014, Hogan et al 2014. That is, given that material weakness disclosures are costly and that it may be difficult for external users to predict them (unlike going concern opinions), audit clients have an incentive to attempt to manage the audit process to maximize the probability of receiving a clean internal control opinion.…”

Shades of Gray: Internal Control Reporting by Chinese U.S.-Listed Firms

“…We use 302 and 404 disclosures to compare the likelihood of CIPOs, CRMs, and U.S.-domiciled firms to report IICs. This contrasts with a focus in prior research on 404 reporting by the reasoning that audited reports provide more credible evidence (e.g., Kim, Song, and Zhang, 2011;Rice and Weber 2012;Rice, Weber, and Biyu, 2015). However, little direct evidence exists regarding whether 404 disclosures provide more credible evidence of IICs, 10 and conversely, Beneish, Billings, and Hodder (2008) find information content for only 302 reports in market reaction tests of 302 and 404 reports.…”

SOX Section 404 and Corporate Innovation

“…Moreover, compared to Section 302, Section 404 further increases the personal liability CEOs and CFOs associated with their firms' internal control because Section 404 additionally requires executives' attestation of internal control effectiveness and leads to more disclosure of internal control deficiencies (Hermanson and Ye (2009)). Both the attestation and the disclosure further increase managers' personal liability because they can no longer claim the unawareness of internal control weaknesses (Coates (2007), Rice, Weber, and Wu (2015)).…”